Cisco SD-WAN Manager: no workaround, check for compromise

The CVE-2026-76504 vulnerability in Cisco Catalyst SD-WAN Manager, which allows an attacker to bypass API authentication and gain administrator privileges, is already being exploited: the advisory, fixed releases and first steps are covered in our 30 September article. Since then, some details useful to anyone running the platform have emerged: according to Infosecurity Magazine there is no alternative to the update, environments hosted in Cisco’s cloud have already received a mitigation, and Rapid7 recommends checking whether systems have been compromised. On 9 October the Slovak SK-CERT also issued a warning.

This update relies on two sources, and almost all the details come from a single publication, Infosecurity Magazine: each piece of information below is attributed to its source.

No workaround: the update is required

According to Infosecurity Magazine, Cisco states that there are no workarounds that remove the vulnerability without installing the security update. The exposure-reduction measures listed in the advisory (no direct Internet access, management connections only from known addresses, a firewall) still help lower the risk, but they do not fix the flaw: a Manager running a vulnerable release can be attacked by anyone who can reach its interface.

The publication also recalls the root cause: improper handling of URI encoding in HTTP requests lets a crafted request slip past the authentication rules and reach the API with administrator permissions. Again according to Infosecurity Magazine, any Manager with ports exposed to the Internet is potentially at risk.

Cisco cloud environments: mitigation already applied

Infosecurity Magazine reports that Cisco has already deployed a mitigation in Cisco Catalyst SD-WAN Cloud Hosted environments. The vendor adds a caveat: the mitigation worked in a test environment, but it is up to customers to confirm that it is applicable and effective in their own environment and conditions of use.

The distinction has practical consequences:

• self-managed Managers, in your data centre or in a cloud run by your company: upgrading to a fixed release is your responsibility;
• Cloud Hosted environments: Cisco applied the mitigation, but checking that it works is still up to the customer.

After the update: look for compromise

The most actionable advice comes from Rapid7. In a post dated 1 October, cited by Infosecurity Magazine, the company recommends moving to a fixed release without waiting for the regular patch cycle and, since exploitation has already occurred, checking affected systems for compromise.

The update closes the hole, but it does not undo what an attacker may have done beforehand. According to Infosecurity Magazine, with administrator access to the API an attacker could move through the managed network and alter or delete files and backups. The sources do not describe real attacks with these consequences: this is what the access would make possible. In MITRE ATT&CK terms, after initial exploitation (T1190, Exploit Public-Facing Application), deleting backups would fall under T1490 (Inhibit System Recovery) and deleting files under T1485 (Data Destruction).

Neither source names threat actors, campaigns or affected sectors, or gives indicators of compromise beyond those in the Cisco advisory.

The bigger picture

• SK-CERT: on 9 October, nine days after the advisory, the Slovak national CSIRT published a warning titled “VAROVANIE” (warning) about an actively exploited critical zero-day vulnerability in Cisco Catalyst SD-WAN.
• CISA: as already reported, the vulnerability is in the Known Exploited Vulnerabilities catalogue; Infosecurity Magazine notes that the agency recommends applying the mitigations.
• Cisco ISE: Infosecurity Magazine recalls that in September Cisco reported active exploitation of CVE-2026-76460, with a CVSS score of 10, in Cisco Identity Services Engine (ISE), another product that governs network infrastructure.

Impact for European and Italian companies

More than a week after the fix, the vulnerability is still the subject of warnings from European CSIRTs, as SK-CERT’s shows. For organisations running networks with many sites, the backup risk described by Infosecurity Magazine is the most sensitive one: if an attacker has altered or deleted backup copies, recovery after an incident becomes slower and less reliable.

For entities under NIS2, the case touches two obligations: handling exploited vulnerabilities with documented priorities and timelines, and business continuity, which includes backup and recovery. A confirmed compromise must be assessed for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN. In healthcare, where SD-WAN may link different sites and access to clinical systems, it is worth checking backups before you need them.

What to do now

1. Know which model you use: a self-managed Manager or a Cisco Cloud Hosted environment.
2. If you manage it yourself, upgrade now to a fixed release (the list is in the previous article), without waiting for the regular maintenance window. There are no workarounds.
3. If you are on Cloud Hosted, check in your own environment that the mitigation applied by Cisco is effective, as the vendor asks.
4. Look for signs of compromise, as Rapid7 recommends: compare your systems with the indicators in the Cisco advisory and review the logs of calls to the management API, the administrator accounts and recent configuration changes.
5. Check your backups: make sure the backup copies of the SD-WAN environment are intact and complete, and keep a separate copy that the Manager cannot reach.
6. If you find traces of access: treat the event as an incident, preserve evidence before restoring and assess your notification obligations.

How ARXDOME helps

ARX Expose shows which services your company exposes on the Internet and which have known vulnerabilities, so you know whether the Manager interface can be reached from outside. ARX Sentry collects logs from firewalls and other network devices in a central collector, which helps you look for anomalous access in the period before the update. ARX Retain stores logs on European storage with object lock, which prevents them from being altered or deleted: the collected traces remain available for the investigation even if systems have been tampered with.

Last updated: 9 October 2026